The API Report CardAPI Index
WordPress.com

WordPress.com API

wordpress.com

WordPress.com runs a fully public REST API across /rest/, /wp/ (core), and /wpcom/ namespaces, the same surface that powers Calypso and the official mobile apps. Access is self-serve with OAuth2 or Application Passwords. Rate limits exist but are never published as numbers.

Last verified: July 2026Software & Data Tools
API GRADE
A
VERIFIED JUL 2026

SCORECARD

ExistenceGOODPublic REST API in three namespaces: WordPress.com endpoints, core WP REST, and platform features under /wpcom/.
AccessGOODFully self-serve: register an OAuth2 app or use Application Passwords; no approval process or paid gate.
CoverageGOODSites, posts, comments, media, taxonomy, stats, and follows; Business plans add SFTP, WP-CLI, and Git level access.
AuthGOODOAuth2 Authorization Code for production plus Application Passwords; the Password Grant is dev-only by policy.
Docs & DXGOODdeveloper.wordpress.com includes an interactive console and a multi-language examples repo; webhooks come via Jetpack.
StabilityGOODThe same API powers Calypso and the official mobile apps, so the public surface is load-bearing for Automattic itself.
MORE FROM THE REPORT CARD
Supergood: WordPress.com shipped a real API. Most vendors don't; we ship near-native APIs for the rest.

Frequently asked questions

WordPress.com scores A on the API Report Card. WordPress.com runs a fully public REST API across /rest/, /wp/ (core), and /wpcom/ namespaces, the same surface that powers Calypso and the official mobile apps. Access is self-serve with OAuth2 or Application Passwords. Rate limits exist but are never published as numbers.

Tried to integrate with WordPress.com?
SOURCES
WordPress.com REST API rate limits are not publicly documented as specific numeric values, developers must reverse-engineer them from 429 responses github.com β†—
Rate limits hit hard in headless CMS configurations where JavaScript frontends make many API calls; shared hosts and WordPress.com lower tiers enforce strictly, producing HTTP 429 errors troubleshoothub.com β†—
WordPress's default stack assumes server-rendered PHP/HTML pages, not API-heavy headless usage, performance degrades without CDN, custom caching, or migration to a host optimized for API traffic troubleshoothub.com β†—
REST API is generally slower than GraphQL alternatives (WPGraphQL plugin) for dynamic headless apps, which is itself a third-party plugin not officially supported by Automattic troubleshoothub.com β†—
Application Passwords require two-factor authentication to be enabled, adding a setup step for developers building simple scripts developer.wordpress.com β†—
OAuth2 Password Grant is supported but explicitly 'never use in production', pushes all real integrations to the Authorization Code flow which requires a registered application developer.wordpress.com β†—
Plugin-installation gating means the WPGraphQL, custom REST endpoints, and webhook plugins that fix many of the above complaints are not available on Free/Personal/Premium plans, developers must be on Business+ ($25/mo+) wordpress.com β†—
Three overlapping API namespaces (/rest/, /wp/, /wpcom/) require developers to pick the right one and understand the compatibility differences developer.wordpress.com β†—
WP Engine vs Automattic dispute has spilled into the plugin ecosystem, including questions about ACF (Advanced Custom Fields) which many headless WordPress integrations depend on for structured content en.wikipedia.org β†—
WordPress finished last among major website builders for Core Web Vitals performance scores in 2025-2026 comparisons yourwebteam.io β†—
Plugin and theme installation is gated behind the Business plan ($25/mo+), Free, Personal, and Premium users cannot install third-party plugins, frustrating users who expected full WordPress functionality wordpress.com β†—
Steep learning curve relative to drag-and-drop builders like Wix/Squarespace; non-technical users report difficulty navigating the WP admin and Gutenberg editor yourwebteam.io β†—
Free plan shows WordPress.com ads and limits stats to 7 days of history wordpress.com β†—
Performance optimization on WordPress.com is host-controlled, users on lower tiers cannot tune caching, CDN, or server-side settings troubleshoothub.com β†—
Ongoing Automattic vs WP Engine legal/community dispute (2024-2025) has created uncertainty about plugin distribution, the WordPress.org plugin repo, and trademark enforcement en.wikipedia.org β†—
Pricing creep, Business plan went from a clear value tier to crowding against $40/mo+ premium hosting (WP Engine, Kinsta) without matching their performance/support story wordpress.com β†—
Enterprise pricing (WordPress VIP starting $25K/yr) is opaque and significantly higher than mid-market managed WP hosts wpvip.com β†—
Migration friction off WordPress.com to self-hosted WordPress requires the Business plan ($25/mo) to get SFTP/SSH access, Free/Personal/Premium users cannot fully export their site programmatically wordpress.com β†—
Theme and design customization on lower tiers is constrained to the block editor and the theme's built-in style options; CSS editing and custom themes are paid features wordpress.com β†—